﻿#include <iostream>
#include<Windows.h>
void Hack() {//攻击函数
    std::cout << "sadfsaf" << std::endl;
}
class AIM {
public:
    //[unknown]
    int HP;//+0x0
    virtual void Eat() {
        std::cout << "AIM" << std::endl;
    }
    virtual void Die() {
        std::cout << "AIM-DIE" << std::endl;
    }
};
class WOLF :public AIM {
public:
    virtual void Eat() {
        std::cout << "WOLF" << std::endl;
    }
    virtual void Die() {
        std::cout << "WOLF-DIE" << std::endl;
    }
    void Sound() {
        std::cout << "aoaoaoao~" << std::endl;
    }
};
int main()
{
    AIM* wolf = new WOLF();
    wolf->Die();//WOLF-DIE

    std::cout << sizeof(AIM) << std::endl;//8
    std::cout << wolf << " " << &wolf->HP << std::endl;//在X86下，00C7F4A0 00C7F4A4，类地址与变量地址之间相差4字节，由此可以得知之间存在一个指针

    unsigned* vtable = (unsigned*)wolf;//该值是wolf内存地址存放的值，也就是VTABLE的内存地址
    std::cout << std::hex << "VTABLE:" << vtable[0] << std::endl;//VTABLE:f1ab60，该值是wolf内存地址存放的值，也就是VTABLE的内存地址
    unsigned* func = (unsigned*)vtable[0];//虚表第一位的值

    std::cout << std::hex << "eat:" << func[0] << std::endl;//eat:f110e1
    std::cout << std::hex << "die:" << func[1] << std::endl;//die:f11163

    //解除修改限制
    DWORD old;
    VirtualProtect(func, 8, PAGE_EXECUTE_READWRITE, &old);

    //修改表值
    func[0] = (unsigned)Hack;
    func[1] = (unsigned)Hack;
    func[2] = (unsigned)Hack;
    wolf->Eat();

    WOLF aWolf;//初始化对象
    aWolf.Sound();//该函数是普通函数
    aWolf.Eat();//该虚函数没有被上面的劫持所更改

    AIM* _aim = new WOLF();
    _aim->Eat();

    int b = 1;
    int* a{&b};
    std::cout << a << std::endl;
    std::cout << *a << std::endl;
    std::cout << &a << std::endl;

    int* a1 = (int*)a;
    std::cout  << a1[0] << std::endl;
}